Full Report
A data breach involving CallonDoc was reported in January 2026. See incident details, impact on customers, and recommended security measures.
Analysis Summary
# Incident Report: CallonDoc Patient Data Exposure
## Executive Summary
In January 2026, CallonDoc disclosed a significant data breach that originally occurred in December 2025. The compromise exposed the records of over 1.14 million patients, including highly sensitive personal and medical information. The breach was discovered after information related to the exposed data began circulating for sale on the dark web.
## Incident Details
- Discovery Date: January 22, 2026 (Date reported publicly)
- Incident Date: December 2025 (Approximate date of the data leak/breach)
- Affected Organization: CallonDoc (callondoc.com)
- Sector: Telemedicine/Healthcare
- Geography: Not specified (Organization location unknown from context)
## Timeline of Events
### Initial Access
- Date/Time: Prior to or during December 2025
- Vector: Unknown (Attacker or cause not identified in reports)
- Details: Unauthorized access resulted in the compromise of patient databases.
### Lateral Movement
- Details: Unknown. Attackers successfully accessed and collected data pertaining to medical conditions and personal identifiers.
### Data Exfiltration/Impact
- Data Exfiltration: The compromised data set, consisting of 1,144,223 patient records, was offered for sale on the dark web for $5,000 USD.
- Impact: Exposure of patient names, addresses, phone numbers, email addresses, medical categories, and conditions.
### Detection & Response
- Detection: The incident was detected after reports surfaced on the dark web alleging the sale of the data.
- Response actions taken: Specific response actions taken by CallonDoc were not detailed, but standard protocols would involve securing systems, customer notification, and remediation.
## Attack Methodology
- Initial Access: Unknown
- Persistence: Unknown
- Privilege Escalation: Unknown
- Defense Evasion: Unknown
- Credential Access: Unknown
- Discovery: Unknown
- Lateral Movement: Unknown
- Collection: Data extraction from patient records resulting in the scope of 1,144,223 records.
- Exfiltration: Data sold or posted on the dark web.
- Impact: Privacy violation, potential for identity theft, and social engineering against affected patients.
## Impact Assessment
- Financial: Estimated sales price on the dark web was $5,000 USD (This is not the cost of the breach to CallonDoc).
- Data Breach: 1,144,223 patient records compromised. Data included names, addresses, phone numbers, email addresses, medical categories, and conditions.
- Operational: Not specified, but significant security overhaul/investigation likely required.
- Reputational: Negative impact due to the disclosure of sensitive patient health information (PHI).
## Indicators of Compromise
*NOTE: No specific threat intelligence (IPs, hashes) was provided in the source article.*
- Network indicators: None provided.
- File indicators: None provided.
- Behavioral indicators: Unauthorized access/dumping of electronic patient records (EPRs).
## Response Actions
- Containment measures: Expected to include isolating affected systems and revoking unauthorized access.
- Eradication steps: Expected to involve patching vulnerabilities exploited, changing affected credentials, and cleaning compromised systems.
- Recovery actions: Expected to involve restoring data integrity (if possible) and notifying affected parties.
## Lessons Learned
- Weaknesses in data security allowed unauthorized access to sensitive PII and PHI for an extended period (December to January).
- Data monitoring practices (internal or external) failed to detect the exfiltration or intent to sell the data internally before it reached the dark web.
## Recommendations
- Implement mandatory and enforced Multi-Factor Authentication (MFA) across all sensitive administrative and production systems.
- Enhance vulnerability and patch management cadence, especially for systems handling patient data, to prevent initial access vectors.
- Deploy comprehensive data loss prevention (DLP) solutions capable of monitoring and alerting on large-scale data transfers from database environments.
- For all affected individuals: Change passwords on all accounts sharing credentials with CallonDoc, enable MFA, and closely monitor medical/financial statements for signs of fraud or misuse of medical conditions.